
JAM: JOIN-ACCUMULATE MACHINE DRAFT 0.3.7
∆
September 11, 2024 7
We denote modulo subscription as s[i]
↺
≡ s[i % s].
We denote the final element x of a sequence s = [..., x]
through the function last(s)≡ x.
3.7.1. Construction. We may wish to define a sequence
in terms of incremental subscripts of other values:
[x
0
, x
1
, . . . ]
n
denotes a sequence of n values beginning
x
0
continuing up to x
n−1
. Furthermore, we may also
wish to define a sequence as elements each of which
are a function of their index i; in this case we denote
[f(i) i <
−
N
n
] ≡ [f (0), f (1), . . . , f (n − 1)]. Thus, when
the ordering of elements matters we use <
−
rather than
the unordered notation ∈. The latter may also be written
in short form [f (i <
−
N
n
)]. This applies to any set which
has an unambiguous ordering, particularly sequences, thus
[i
2
i <
−
[1, 2, 3]] = [1, 4, 9]. Multiple sequences may be
combined, thus [i ⋅ j i <
−
[1, 2, 3], j <
−
[2, 3, 4]]= [2, 6, 12].
We use explicit notation f
#
to denote a function map-
ping over all items of a sequence. Thus given some func-
tion y = f (x):
(11) [f(x
0
), f (x
1
), . . . ]= f
#
([x
0
, x
1
, . . . ])
Sequences may be constructed from sets or other se-
quences whose order should be ignored through sequence
ordering notation [i
k
i ∈ X], which is defined to result
in the set or sequence of its argument except that all ele-
ments i are placed in ascending order of the corresponding
value i
k
.
The key component may be elided in which case it is as-
sumed to be ordered by the elements directly; i.e. [i ∈ X]≡
[i
i ∈ X]. [i
k
i ∈ X] does the same, but excludes any
duplicate values of i. E.g. assuming s = [1, 3, 2, 3], then
[i
i ∈ s]= [1, 2, 3] and [−i
i ∈ s]= [3, 3, 2, 1].
Sets may be constructed from sequences with the reg-
ular set construction syntax, e.g. assuming s = [1, 2, 3, 1],
then {a a ∈ s} would be equivalent to {1, 2, 3}.
Sequences of values which themselves have a defined
ordering have an implied ordering akin to a regular dic-
tionary, thus [1, 2, 3]< [1, 2, 4] and [1, 2, 3]< [1, 2, 3, 1].
3.7.2. Editing. We define the sequence concatenation op-
erator ⌢ such that [x
0
, x
1
, . . . , y
0
, y
1
, . . . ] ≡ x ⌢ y. For
sequences of sequences, we define a unary concatenate-all
operator:
x ≡ x
0
⌢ x
1
⌢ . . . . Further, we denote ele-
ment concatenation as x i ≡ x ⌢ [i]. We denote the
sequence made up of the first n elements of sequence s to
be
Ð→
s
n
≡ [s
0
, s
1
, . . . , s
n−1
], and only the final elements as
←Ð
s
n
.
We define
T
x as the transposition of the sequence-of-
sequences x, fully defined in equation 317. We may also
apply this to sequences-of-tuples to yield a tuple of se-
quences.
We denote sequence subtraction with a slight modifica-
tion of the set subtraction operator; specifically, some se-
quence s excepting the left-most element equal to v would
be denoted s m {v}.
3.7.3. Boolean values. B
s
denotes the set of Boolean
strings of length s, thus B
s
= {, ⊺}
s
. When dealing
with Boolean values we may assume an implicit equiva-
lence mapping to a bit whereby ⊺ = 1 and = 0, thus
B
◻
= N
2
◻
. We use the function bits(Y) ∈ B to de-
note the sequence of bits, ordered with the least signif-
icant first, which represent the octet sequence Y, thus
bits([5, 0])= [1, 0, 1, 0, 0, . . . ].
3.7.4. Octets and Blobs. Y denotes the set of octet strings
(“blobs”) of arbitrary length. As might be expected, Y
x
denotes the set of such sequences of length x. Y
$
denotes
the subset of Y which are ASCII-encoded strings. Note
that while an octet has an implicit and obvious bijec-
tive relationship with natural numbers less than 256, and
we may implicitly coerce between octet form and natural
number form, we do not treat them as exactly equivalent
entities. In particular for the purpose of serialization, an
octet is always serialized to itself, whereas a natural num-
ber may be serialized as a sequence of potentially several
octets, depending on its magnitude and the encoding vari-
ant.
3.7.5. Shuffling. We define the sequence-shuffle function
F, originally introduced by Fisher and Yates 1938, with an
efficient in-place algorithm described by Wikipedia 2024.
This accepts a sequence and some entropy and returns a
sequence of the same length with the same elements but
in an order determined by the entropy. The entropy may
be provided as either an indefinite sequence of naturals or
a hash. For a full definition see appendix F.
3.8. Cryptography.
3.8.1. Hashing. H denotes the set of 256-bit values typi-
cally expected to be arrived at through a cryptographic
function, equivalent to Y
32
, with H
0
being equal to [0]
32
.
We assume a function H(m ∈ Y)∈ H denoting the Blake2b
256-bit hash introduced by Saarinen and Aumasson 2015
and a function H
K
(m ∈ Y)∈ H denoting the Keccak 256-
bit hash as proposed by Bertoni et al. 2013 and utilized
by Wood 2014.
We may sometimes wish to take only the first x octets
of a hash, in which case we denote H
x
(m)∈ Y
x
to be the
first x octets of H(m). The inputs of a hash function are
generally assumed to be serialized with our codec E(x)∈ Y,
however for the purposes of clarity or unambiguity we may
also explicitly denote the serialization. Similarly, we may
wish to interpret a sequence of octets as some other kind
of value with the assumed decoder function E
−1
(x ∈ Y). In
both cases, we may subscript the transformation function
with the number of octets we expect the octet sequence
term to have. Thus, r = E
4
(x ∈ N) would assert x ∈ N
2
32
and
r
∈
Y
4
, whereas s = E
−1
8
(y) would assert y ∈ Y
8
and
s ∈ N
2
64
.
3.8.2. Signing Schemes. E
k
m ⊂ Y
64
is the set of valid
Ed25519 signatures, defined by Josefsson and Liusvaara
2017, made through knowledge of a secret key whose pub-
lic key counterpart is k ∈ Y
32
and whose message is m.
To aid readability, we denote the set of valid public keys
k ∈ H
E
.
We use Y
BLS
⊂ Y
144
to denote the set of public keys for
the bls signature scheme, described by Boneh, Lynn, and
Shacham 2004, on curve bls12-381 defined by Hopwood
et al. 2020.
We denote the set of valid Bandersnatch public keys as
H
B
, defined in appendix G. F
m∈Y
k∈H
B
x ∈ Y⊂ Y
96
is the set
of valid singly-contextualized signatures of utilizing the se-
cret counterpart to the public key k, some context x and
message m.
¯
F
m∈Y
r∈Y
R
x ∈ Y⊂ Y
784
, meanwhile, is the set of valid Ban-
dersnatch Ringvrf deterministic singly-contextualized
proofs of knowledge of a secret within some set of secrets